Look up another CVE · open CVE-2026-97926 in the interactive tracker
CVE-2026-97926
ufs: validate cylinder group metadata before caching it
Published 2026-09-25 (24 days ago) by the Linux kernel CNA. Subsystem fs/ufs. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-97926 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4841-1 · 2026-10-17 · text | 6.1.190-1 | Update the kernel and reboot. DLA-4841-1 shipped the fix on 2026-10-17, in 6.1.190-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6528-1 · 2026-09-29 · text | 6.12.111-1 | Update the kernel and reboot. DSA-6528-1 shipped the fix on 2026-09-29, in 6.12.111-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.2.7-1 | Update the kernel and reboot. Fixed in 7.2.7-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.7-1 | Update the kernel and reboot. Fixed in 7.2.7-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4817-1 · 2026-10-04 · text | 6.12.111-1~deb12u1 | Update the kernel and reboot. DLA-4817-1 shipped the fix on 2026-10-04, in 6.12.111-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
ufs_read_cylinder() copies the cylinder group index and the rotor positions straight from the on-disk group and caches them without any check: ucpi->c_cgx = fs32_to_cpu(sb, ucg->cg_cgx); ucpi->c_rotor = fs32_to_cpu(sb, ucg->cg_rotor); ucpi->c_frotor = fs32_to_cpu(sb, ucg->cg_frotor); ucpi->c_irotor = fs32_to_cpu(sb, ucg->cg_irotor); They are then used as indices during allocation and free: - c_cgx indexes the cylinder summary array as UFS_SB(sb)->fs_cs(ucpi->c_cgx), so a value past s_ncg writes a 32 bit count outside the s_csp allocation. - c_frotor becomes a bitmap scan start, start = c_frotor >> 3, and then length = ((s_fpg + 7) >> 3) - start. A start beyond the block bitmap wraps the unsigned length to a huge value, so ubh_scanc() walks far past the cylinder group buffers. c_irotor drives the inode bitmap the same way. A crafted image can set any of these freely, turning an ordinary allocation into an out of bounds access. Reject a cylinder group whose recorded index does not match the group being read, or whose rotors fall outside the group, before the metadata is cached. Valid filesystems keep cg_cgx equal to the group number and the rotors within the group, so only malformed images are rejected.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
fs/ufs/cylinder.c
- What this is
- FILESYSTEMS (VFS and infrastructure)MAINTAINERS section matched on fs/* · linux-fsdevel@vger.kernel.org · Maintained
- Kernel module
- ufs
Check it on the machine
grep -w CONFIG_UFS_FS /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w ufsPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.
- bookworm, trixie, forky, sid, bookworm · linux-6.12Mnot built on amd64/cloud-amd64, arm64/cloud-arm64
- M
- a module where it is built at all; some flavours do not build it
- Build switch
- CONFIG_UFS_FS
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-25 (24 days ago)source
- CVSS
- 7.0 high
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.15%, higher than 4.1% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- fs/ufs
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 2.6.12 | 5.10.271 | 88cccb6beba1 |
| 2.6.12 | 5.15.222 | f560a9e33365 |
| 2.6.12 | 6.1.189 | e4c5cc9688c3 |
| 2.6.12 | 6.6.158 | 58c0c414b2b8 |
| 2.6.12 | 6.12.111 | 5902a9506688 |
| 2.6.12 | 6.18.53 | 87b12dc360a0 |
| 2.6.12 | 7.2.7 | abde9eb33106 |
| 2.6.12 | 7.3 | c9d263be2680 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4841-1 | 2026-10-17 | bookworm 6.1.190-1 | tracker |
| DLA-4817-1 | 2026-10-04 | bookworm 6.12.111-1~deb12u1 | tracker |
| DSA-6528-1 | 2026-09-29 | trixie 6.12.111-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The bad cg_cgx/cg_rotor/cg_frotor/cg_irotor values come from a crafted UFS image's cylinder group block, read by ufs_read_cylinder(). They are then used by the local VFS allocate/free paths (ufs_new_fragments, ufs_free_fragments, ufs_new_inode, ufs_free_inode). No network protocol carries these bytes.
- AC:HAttack complexity, high
- ufs_load_cylinder() is called only from the allocate/free paths in balloc.c and ialloc.c. These need a read-write mount, and ufs_fill_super() returns -EROFS for one unless the non-default CONFIG_UFS_FS_WRITE ("DANGEROUS") is set. Major distros leave it off and only a few MIPS defconfigs set it, so reaching the bug depends on a rare kernel config.
- PR:NPrivileges required, none
- The attacker only has to craft the image. The ufs file_system_type sets FS_REQUIRES_DEV without FS_USERNS_MOUNT, so the mount is done by a privileged victim, not the attacker. After that, creating or extending a file triggers the allocation.
- UI:RUser interaction, required
- A victim has to mount the attacker-supplied UFS image read-write before ufs_read_cylinder() caches the malformed cylinder group fields.
- S:UScope, unchanged
- The out-of-bounds accesses stay in kernel heap memory in the same kernel security authority. No guest/host or hardware boundary is crossed.
- C:HConfidentiality impact, high
- If c_frotor/c_irotor lie outside the group, the unsigned length in ufs_bitmap_search() wraps. ubh_scanc() then reads far past the cylinder group buffers, an unbounded out-of-bounds read of kernel memory.
- I:HIntegrity impact, high
- ufs_add_fragments()/ufs_free_* call fs32_add() on UFS_SB(sb)->fs_cs(ucpi->c_cgx). An attacker-chosen c_cgx beyond s_ncg adds to a 32-bit value outside the s_csp heap allocation, an out-of-bounds heap write at a chosen index.
- A:HAvailability impact, high
- The wild ubh_scanc() walk and the out-of-bounds fs_cs() writes can oops the kernel or corrupt the heap, crashing the system.